Splunk Phantom

Errno 110 App ElasticSearch Configuration

Explorer

I have been trying to troubleshoot this error for the Elasicsearch application. However, with or without credentials I have run into the same error output.

App 'Elasticsearch' started successfully (id: 157241367048) on asset: 'elastic'(id: 13)
Loaded action execution configuration
Connecting to 192.168.30150:9200...
Querying cluster health to check connectivity
Using authentication
Connection failed. Error string 'HTTPConnectionPool(host='192.168.30.150',port=9200): Max retries exceeded with url:/_cluster/health (Caused by NewConnectionError(':Failed to establish a new connection: [Errno 110] Connection timed out'))'. Test Connectivity Failed. No action executions found.

The above cycle then continues to repeat itself with the same output when undergoing Testing Connectivity.

Labels (1)
Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

a timeout error like this typically indicates a network connectivity issue preventing the connection (firewall/proxy) - I would recommend running some connection tests from the phantom host to your ES instance. netcat/telnet/traceroute are a good place to start troubleshooting.

View solution in original post

Splunk Employee
Splunk Employee

a timeout error like this typically indicates a network connectivity issue preventing the connection (firewall/proxy) - I would recommend running some connection tests from the phantom host to your ES instance. netcat/telnet/traceroute are a good place to start troubleshooting.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!